Anomaly detection method and device, terminal and storage medium

ABSTRACT

An anomaly detection method and device, a terminal and a storage medium are disclosed. The method may include: generating at least one clustering set of objects based on configuration data and performance indicator data of the objects; determining an algorithm configuration parameter corresponding to each clustering set based on a preset anomaly detection algorithm and the performance indicator data corresponding to the objects in the clustering set; and determining, based on the algorithm configuration parameter, abnormal performance indicator data of the objects in the corresponding clustering set, so as to determine abnormal objects based on the abnormal performance indicator data.

CROSS-REFERENCE TO RELATED APPLICATION

This application is a national stage filing under 35 U.S.C. § 371 ofinternational application number PCT/CN2020/112150, filed Aug. 28, 2020,which claims priority from Chinese Patent Application No.201910901446.4, filed on 23 Sep. 2019. The contents of theseapplications are incorporated herein by reference in their entirety.

TECHNICAL FIELD

Embodiments of the present application relates to a wirelesscommunication network, in particular to an anomaly detection method anddevice, a terminal and a storage medium.

BACKGROUND

The operation and maintenance of current wireless communication systemsand the evaluation of network quality and performance are implementedbased on basic Performance Indicators (PIs) and Key PerformanceIndicators (KPIs). A huge volume of PI and KPI data (i.e., performanceindicator data) will be generated during the operation of wirelesscommunication network systems. When facing such scale of performanceindicator data, there are limitations in terms of accuracy andself-adaptability if any abnormal performance indicator data is detectedby manual analysis.

SUMMARY

In view of this, embodiments of the present application provide ananomaly detection method, including: generating at least one clusteringset of objects based on configuration data and performance indicatordata of the objects; determining an algorithm configuration parametercorresponding to each clustering set based on a preset anomaly detectionalgorithm and the performance indicator data corresponding to theobjects in the clustering set; and determining, based on the algorithmconfiguration parameter, abnormal performance indicator data of theobjects in the corresponding clustering set , so as to determineabnormal objects based on the abnormal performance indicator data.

Embodiments of the present application provide an anomaly detectiondevice, including: a clustering set generation module, configured togenerate at least one clustering set of objects based on configurationdata and performance indicator data of the objects; a parameterdetermination module, configured to determine an algorithm configurationparameter corresponding to each clustering set based on a preset anomalydetection algorithm and the performance indicator data corresponding tothe objects in the clustering set; and an anomaly detection module,configured to determine, based on the algorithm configuration parameter,abnormal performance indicator data of the objects in the correspondingclustering set, so as to determine abnormal objects based on theabnormal performance indicator data.

Embodiments of the present application provide a terminal, including: amemory, and one or more processors, where the memory is configured tostore one or more programs; and the one or more programs, when executedby the one or more processors, cause the one or more processors toperform the anomaly detection method of any one of the embodiments ofthe present application.

Embodiments of the present application provide a storage medium storinga computer program, where the computer program, when executed by aprocessor, causes the processor to perform the anomaly detection methodof any one of the embodiments of the present application.

With respect to the above embodiments and other aspects of the presentapplication and implementations thereof, more description is provided inthe brief description of drawings, detailed description and claims.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a schematic diagram of a basic architecture of an existingwireless communication network system;

FIG. 2 is a flow chart of an anomaly detection method provided in anembodiment of the present application;

FIG. 3 is a processing flow chart of configuration data in the anomalydetection method provided in the embodiment of the present application;

FIG. 4 is a processing flow chart of determining a clustering set in theanomaly detection method provided in the embodiment of the presentapplication;

FIG. 5 is a flow chart of another anomaly detection method provided inthe embodiment of the present application;

FIG. 6 is a schematic diagram of a logical dependency between objectsprovided in the embodiment of the present application;

FIG. 7 is a schematic diagram of attribution reduction of abnormalobjects provided in the embodiment of the present application;

FIG. 8 is a schematic structural block diagram of an anomaly detectiondevice provided in the embodiment of the present application;

FIG. 9 is a processing flow diagram of another anomaly detection deviceprovided in the embodiment of the present application;

FIG. 10 is a schematic diagram of a wireless communication networksystem provided in the embodiment of the present application; and

FIG. 11 is a structure diagram of a terminal provided in the embodimentof the present application.

DETAILED DESCRIPTION

In order to make the purposes, technical themes and advantages of thepresent application clearer, the following will describe the embodimentsof the present application in detail with reference to the accompanyingdrawings. It should be noted that the embodiments of the presentapplication and the features in the embodiments may be arbitrarilycombined to derive other embodiments not explicitly described.

For ease of understanding, a brief introduction to a basic architectureof a wireless communication network system is given first. FIG. 1 is aschematic diagram of a basic architecture of an existing wirelesscommunication network system. As shown in FIG. 1, the wirelesscommunication network system mainly includes objects such as a corenetwork 140, base stations 130, cells 120, terminals 110 andtransmission links 150. It should be noted that the objects includefunction modules for constructing a wireless communication networksystem. The objects are not limited to those listed above, but may alsobe a baseband processing module, a radio frequency processing module,etc., which are not specifically defined in the embodiments of thepresent application.

The terminal 110 is a general term for network access devices used byusers. For example, the terminal may be a mobile phone. The terminal andthe base station conduct wireless data interaction through theirrespective antennas, and then access the network for uploading services(such as voice calls or Internet access).

The base station 130 is a core device for constructing the wirelesscommunication network system. It interacts upward with the terminalthrough a wireless communication protocol and downward with the corenetwork through the transmission link, and is responsible for forming adata channel between the terminal and the core network. Most wirelesscommunication protocols are implemented in the base station.

The cell 120 is a virtual management object. In order to achieve anoptimal balance between wireless signals in a service area of the systemin terms of coverage, interference, access capacity and other factors,planners generally divide the entire service area into many cells andset different parameters for each cell. In most cases, the terminal willgenerally access the network through a geographically close cell.

The core network 140 is responsible for end user authentication,billing, and processing of all service data. When the base station formsa data channel between the terminal and the core network, the servicedata (such as voice data and Internet data) initiated by the terminalneeds to be processed or forwarded through the core network.

The transmission link 150 generally refers to a wired transmission linkconnecting the base station and the core network. Since all terminalservice data are eventually aggregated to the core network through thebase station, there are generally high requirements on the bandwidth,reliability and delay of the transmission link.

It should be noted that FIG. 1 is only a schematic diagram of thearchitecture of the wireless communication network system, and theactual network architecture of the wireless communication network systemis more complicated. However, the network architecture shown in FIG. 1is conceptually correct, and can help understand the basic structure ofthe wireless communication network system and the technical problems tobe solved by the embodiments of the present application.

In order to facilitate the operation and maintenance of the wirelesscommunication network system and to set a unified evaluation standardfor network quality and performance, the 3GPP standard organization hasformulated a batch of basic performance indicators (PIs) and keyperformance indicators (KPIs) in several standard documents, and hasgiven the meaning, collection contents, collection conditions andrelated operational formulas of the indicators. All communication devicemanufacturers are required to comply with the requirements of thestandard, implement and report these PIs in a network device, summarizethe PIs in a network management system (hereinafter referred to as NMS),and calculate the KPIs according to the formula. In addition, devicemanufacturers and operators generally also design and implement a batchof PIs or KPIs beyond the standard according to their own specific needsto monitor the key operation state of the system.

In most cases, the wireless communication network system will generate asurprisingly huge volume of KPI and PI data during its operation. Withdata on such a scale, it is very difficult to try to analyze the datamanually and find anomalies therein. The NMS generally implements someauxiliary functions to help operation and maintenance personnel observeand analyze the data. For example, the NMS provides a visual Kanbansystem, which allows users to observe and understand data in the form ofcharts. For another example, the NMS provides descending sorting andscreening functions, so that users can focus on the indicators with thegreatest amount of variation. For another example, the NMS provides analarm system, so that the user can set an alarm threshold or rule forthe specified indicators. When the indicator value exceeds the thresholdor triggers the rule, the alarm system will report an alarm to let usersknow of system anomalies.

Although the above functions provided by the NMS can relieve some of theburden of manual analysis of indicators, there are still someshortcomings. For example, the analysis coverage is low. Even with theaid of the Kanban system, TopN or screening tools, the number ofindicators that can be manually observed and analyzed at the same timeis still very limited (generally no more than 10), which is mainly dueto the inherent limitations of human beings. For another example, it isdifficult to specify appropriate alarm thresholds or trigger rules. Acommunication system is complicated and changeable, and different time,space, business scenarios and configurations will have different effectson the performance of the same indicators. It is difficult to accuratelydefine what is abnormal or normal for relevant indicators in suchchangeable scenarios only by human experience and knowledge.

In order to make up for the deficiencies of the auxiliary analysisfunction of the traditional NMS, some improvement schemes are putforward. These improvement schemes consist of two main categories.

The first is to manually maintain an empirical knowledge base foranomaly detection. The empirical knowledge base may be in the form ofmarked historical performance indicator data (i.e., abnormal performanceindicator data has been marked), and may be a set of pattern recognitionrules. The former is generally used to assist statistical trainingprocedures to obtain detection thresholds, while the latter is useddirectly to detect abnormal performance indicator data.

The second is to analyze historical performance indicator data bystatistical analysis methods, so to obtain a threshold fordistinguishing abnormal and normal performance indicator data bycalculation, and apply the threshold to the detection of currentperformance indicator data.

The first category of scheme continues the method of expert system tosolve problems, and has similar effects as follows: the more completethe expert rules available in the system, the more accurate the results.If the problems to be solved do not change significantly, then theexpert system will operate well. However, the actual situation isgenerally not so ideal, and usually has the following limitations: thecost of manually collecting and summarizing expert rules is very high;due to the limitations of human beings, it is difficult to guarantee thecompleteness and accuracy of expert rules. In reality, many problems tobe solved are changing.

Although the need for expert experience and rules as well as the cost ofmanual intervention or guidance are reduced by adopting the secondcategory of scheme for anomaly detection of performance indicator data,there are still some limitations as follows.

First, most anomaly detection algorithms still require users to set upan algorithm configuration parameter. Although the workload anddifficulty of setting parameters are far less than that of specifyingdetection rules directly, the quality of parameters provided by usersstill directly affects the accuracy of the results output from thealgorithms. For extremely complex and huge systems such as a wirelesscommunication network system, it is very difficult for users to provideappropriate algorithm configuration parameter for different time, spaceand objects.

Second, most anomaly detection algorithms have some assumptions aboutthe characteristic pattern of anomalies (e.g., for the k-nearestneighbor algorithm, it is assumed that anomalies must be far away fromall dense neighborhoods). However, in practice, the abnormal patterns ofthe same object may be different in different time ranges. In otherwords, the abnormal patterns of two similar objects may be different inthe same time range. Under such a premise, it is difficult foralgorithms with basically fixed parameter configurations to makeaccurate anomaly detection for objects under different conditions.

Third, the current mainstream algorithms for anomaly detection basicallytake historical performance indicator data as the only input, whichmeans that the algorithms predict the future of performance indicatordata based only on its history, which affects the accuracy of detectionresults.

In view of this, an embodiment of the present application provides ananomaly detection method to solve the above technical problems.

FIG. 2 is a flow chart of an anomaly detection method provided in theembodiment of the present application, and the method may be performedby an anomaly detection device. The device may be implemented bysoftware and/or hardware and may generally be integrated in a networkmanagement system or exist independently of the network managementsystem.

As shown in FIG. 2, the method provided in the embodiment of the presentapplication includes following steps of S210 to S230.

In a step of S210, at least one clustering set of objects is generatedbased on configuration data and performance indicator data of theobjects.

It should be noted that the objects include function modules forconstructing a wireless communication network system. Taking thewireless communication network system in FIG. 1 as an example, theobjects may be core networks, base stations, cells, terminals andtransmission links. It can be understood that the objects are associatedwith the composition of the wireless communication network system, andwill vary with the composition of the wireless communication networksystem.

In the embodiments of the present application, the configuration datamay be attribute information of the object in terms of configuration.There are many types of configuration data, which are not specificallydefined in the embodiments of the present application. For example, theconfiguration data may include configuration data related to spatialinformation. Alternatively, the configuration data may also includeconfiguration data related to performance indicators. The type ofconfiguration data may be determined based on the type of performanceindicator data for anomaly detection, and then a corresponding type ofconfiguration data may be selected for further processing. It can beunderstood that when there are a variety of performance indicator datato be subjected to anomaly detection, or the performance indicator datato be subjected to anomaly detection includes multiple indicators, it isnecessary to select multiple types of configuration data. It should benoted that the configuration data is usually unchanged by the time thewireless communication network system is constructed and startsoperating. Therefore, when the configuration data changes, it isnecessary to re-acquire the configuration data of the objects in thewireless communication network system from the NMS.

In the embodiments of the present application, the performance indicatordata may be data related to the performance indicator. Performanceindicators are evaluation standards for monitoring network quality andperformance. The performance indicators include PIs or KPIs specified by3GPP, and may also include PIs or KPIs beyond the standards set bydevice manufacturers and operators themselves. It should be noted thatthe performance indicator data is related to the operation of thewireless communication network system, so it is necessary to acquire theperformance indicator data periodically from the wireless communicationnetwork system. In some implementations, the acquisition cycle of theperformance indicator data typically coincides with the reporting andupdating cycle of the performance indicator data reported by networkdevice. For example, the acquisition cycle is the same as the reportingand update cycle. Alternatively, there is an integer multiplerelationship between the acquisition cycle and the reporting andupdating cycle.

It should be noted that the clustering set is a set obtained byclustering the objects by comprehensively considering thecharacteristics of configuration data and performance indicator datacorresponding to the objects. Since the performance indicator data isacquired periodically, at least one clustering set generated based onthe performance indicator data of the current acquisition cycle containsobjects that have similar performance indicator characteristics andfluctuation patterns in the current acquisition cycle. For example, theobjects may be clustered based on the characteristics of theconfiguration data and performance indicator data, respectively, toobtain a sub-clustering set based on the configuration data and asub-clustering set based on the performance indicator data. Consideringthe characteristics of the data in the two sub-clustering sets, logicaloperations are performed on the two sub-clustering sets to obtain atleast one clustering set of the objects. The performance indicator dataof the objects in the same clustering set have similar performanceindicator characteristics and fluctuation patterns.

It should be noted that the performance indicator data is acquiredperiodically, and accordingly, the clustering sets are also generatedperiodically, and the generation cycle of the clustering sets is relatedto the acquisition cycle of the performance indicator data.

In a step of S220, an algorithm configuration parameter corresponding toeach clustering set are determined based on a preset anomaly detectionalgorithm and the performance indicator data corresponding to theobjects in the clustering set.

It should be noted that the preset anomaly detection algorithm is analgorithm for detecting abnormal objects based on the performanceindicator data of the objects. There may be many types of anomalydetection algorithms, which are not specifically defined in theembodiments of the present application. For example, the anomalydetection algorithms may include low-pass filter type algorithms,density-based detection algorithms, clustering detection algorithms andsupport vector machine algorithms. The low-pass filter algorithmincludes moving average or Kalman filter algorithm and its variants. Thedensity-based detection algorithm includes a k-nearest neighbor or localoutlier factor algorithm and its variants. The clustering detectionalgorithm includes a k-means clustering algorithm and its variants. Thesupport vector machine algorithm includes a one-class support vectormachine algorithm and its variants.

In the embodiments of the present application, the algorithmconfiguration parameter is a parameter required to enable the anomalydetection algorithm for anomaly detection. For example, the thresholdfor anomaly detection may be determined based on the algorithmconfiguration parameter. Since the algorithm configuration parametercorrespond to each clustering set, the generation of different algorithmconfiguration parameters for the objects with different characteristicsin different time intervals is implemented, which reduces the workloadof manual analysis and parameter tuning in the field of performanceindicator detection and improves the self-adaptability of the detectionmethod.

In some embodiments, determining an algorithm configuration parametercorresponding to each clustering set based on a preset anomaly detectionalgorithm and the performance indicator data corresponding to theobjects in the clustering set may include training the preset anomalydetection algorithm based on the performance indicator data of theobjects in each clustering set, so as to obtain the algorithmconfiguration parameter corresponding to each clustering set. Forexample, based on a preset acquisition cycle, the performance indicatordata is acquired. The currently acquired performance indicator data arecleaned and regularized to obtain sample data for training the presetanomaly detection algorithm. The sample data corresponds to the objects.A traversal is performed on the clustering sets, and the preset anomalydetection algorithm is trained by the sample data corresponding to theobjects in each clustering set to obtain the algorithm configurationparameter applicable to each clustering set. For example, if sixclustering sets are generated based on the configuration data andperformance indicator data of the objects, the preset anomaly detectionalgorithm is trained based on the performance indicator parameterscorresponding to the objects in the first clustering set to obtain thealgorithm configuration parameter applicable to the first clusteringset. Similarly, the preset anomaly detection algorithm is trained basedon the performance indicator parameters corresponding to the objects inthe second clustering set to obtain the algorithm configurationparameter applicable to the second clustering set. By analogy, thepreset anomaly detection algorithm is trained based on the performanceindicator parameters corresponding to the objects in the sixthclustering set to obtain the algorithm configuration parameterapplicable to the sixth clustering set.

It should be noted that different preset anomaly detection algorithmsare trained in different ways, and the specific training process is notspecifically defined in the embodiments of the present application.

It should be noted that the clustering sets are generated periodically,and accordingly, the algorithm configuration parameter corresponding toeach clustering set is also determined periodically, and the cycle ofdetermining the algorithm configuration parameter is related to thecycle of generating the clustering sets.

In a step of S230, abnormal performance indicator data of the objects inthe corresponding clustering set is determined based on the algorithmconfiguration parameter, so as to determine abnormal objects based onthe abnormal performance indicator data.

It should be noted that the abnormal performance indicator data isperformance indicator data with anomaly. The preset anomaly detectionalgorithm may be adopted to detect the presence of anomaly in theperformance indicator data. Since the performance indicator datacorresponds to the object, after the abnormal performance indicator datais detected, the object corresponding to the data, i.e., the abnormalobject can be determined based on the abnormal performance indicatordata.

In some embodiments, target performance indicator data corresponding tothe objects in the clustering set to be detected is acquired. The targetalgorithm configuration parameter corresponding to the clustering set tobe detected is determined. The anomaly detection is performed on thetarget performance indicator data based on the preset anomaly detectionalgorithm and the target algorithm configuration parameter, and theabnormal performance indicator data in the target performance indicatordata is determined based on anomaly detection results to determine theobject corresponding to the abnormal performance indicator data as anabnormal object.

It should be noted that, in a wireless network communication system,there may be a plurality of objects of the same type, and the pluralityof objects may have different data characteristics, resulting in aplurality of clustering sets. Each clustering set may include at leastone object. For example, the wireless network communication systemincludes 10 cells. The cells are clustered based on the configurationdata and performance indicator data to obtain six clustering sets, andeach clustering set contains two cells.

After the algorithm configuration parameter corresponding to eachclustering set is determined, a clustering set of objects is randomlyacquired as the clustering set to be detected. The object in theclustering set to be detected is determined, and the performanceindicator data corresponding to the object is acquired as the targetperformance indicator data. The algorithm configuration parametercorresponding to the clustering set to be detected is acquired as thetarget algorithm configuration parameter. Based on the target algorithmconfiguration parameter, a preset anomaly detection algorithm is adoptedto perform anomaly detection on the target performance indicator data,and the anomaly performance indicator data in the target performanceindicator data is determined based on the anomaly detection results. Theabove operations are performed on the remaining clustering sets untilall the objects in the clustering sets have been subjected to abnormaldetection on the performance indicator data thereof. All objectscorresponding to the abnormal performance indicator data in eachclustering set are determined as abnormal objects.

It should be noted that the performance indicator data is acquiredperiodically, and accordingly, the abnormal objects in the clusteringset are also determined periodically, and the determination cycle of theabnormal objects is related to the acquisition cycle of the performanceindicator data.

An embodiment of the present application provides an anomaly detectionmethod, including: clustering a plurality of objects based onconfiguration data and performance indicator data of the objects toobtain at least one clustering set; training a preset anomaly detectionalgorithm by the performance indicator data corresponding to eachclustering set to obtain algorithm configuration parameter correspondingto each clustering set; and determining abnormal performance indicatordata of the objects in the corresponding clustering set based on thepreset abnormal detection algorithm and algorithm configurationparameter, so as to determine abnormal objects based on the abnormalperformance indicator data. The above technical scheme makes full use ofconfiguration data other than the performance indicator data, so thatattributes of different components of the system can be grasped moreaccurately, the algorithm configuration parameter can be automaticallyadjusted, and the accuracy of detection and the self-adaptability of thedetection method are improved.

In an implementation, generating at least one clustering set of theobjects based on the configuration data and performance indicator dataof the objects can be optimized as generating at least one clusteringset of the objects based on the configuration data, performanceindicator data and operation state data of the objects. The operationstate data includes service quality data, measurement report, calltracing data, signaling tracing data, user complaint data or other dataassociated with the operation state of the objects. It can be understoodthat the operation state data may be one or more of the data listedabove, which is not specifically defined in the embodiments of thepresent application. The operation state data of the objects can reflectthe operation state of the objects, and generation of the clusteringsets based on the configuration data, performance indicator data andoperation state data of the objects allows to grasp the operation stateand attributes of different objects in the wireless communicationnetwork system more accurately, realizing automatic adjustment of thealgorithm configuration parameter for different systems, differentobjects, different time intervals and other factors.

In some embodiments, generating at least one clustering set of theobjects based on the configuration data, performance indicator data andoperation state data of the objects further includes following steps:

acquiring the configuration data of the objects, and clustering theobjects based on the configuration data to generate a first clusteringset of the objects;

acquiring the performance indicator data of the objects, and clusteringthe objects based on the performance indicator data to generate a secondclustering set of the objects;

clustering the objects based on the operation state data to generate athird clustering set of the objects; and

performing logical operations on the first clustering set, the secondclustering set and the third clustering set based on a preset rule toobtain at least one clustering set of the objects.

It should be noted that the configuration data is usually unchanged bythe time the wireless communication network system is constructed andstarts operating. Therefore, in the subsequent anomaly detectionprocess, if the configuration data is still unchanged, the configurationdata of the objects is acquired, and the objects are clustered based onthe configuration data. The operation of generating the first clusteringset of the objects is only performed once. If the configuration datachanges, it is necessary to acquire the configuration data again, andcluster the objects based on the newly acquired configuration data togenerate a new first clustering set.

FIG. 3 is a processing flow chart of the configuration data in theanomaly detection method provided in the embodiment of the presentapplication. As shown in FIG. 3, the processing flow of acquiringconfiguration data of the objects and clustering the objects based onthe configuration data to generate a first clustering set of the objectsincludes following steps 310 to 340.

In a step of S310, the NMS acquires the configuration data of thewireless network management system, and cleans and regularizes theconfiguration data acquired.

It should be noted that the configuration data is cleaned to removeduplicate data and error data. The configuration data is regularized toclean, transform, merge and reshape the data.

In a step of S320, a logical dependency between the objects in thewireless communication network system is determined based on theconfiguration data.

It should be noted that the logical dependency refers to the logicalconnection between different objects. For example, a base station maycorrespond to a plurality of cells. At this moment, there is a logicaldependency between the cells and the base station. It may be consideredthat the base station is a parent object of the cells while the cellsare a child object of the base station. Alternatively, there is alogical transmission link between each cell and its base station, and aphysical transmission link between each base station and a core network.In terms of the same base station, the physical transmission link is theparent object of the logical transmission link, while the logicaltransmission link is the child object of the physical transmission link.

In general, the logical dependency of the objects in the wirelessnetwork communication system presents a tree structure.

In a step of S330, the objects are clustered based on the configurationdata related to spatial information to obtain a spatial clustering setof the objects clustered based on the spatial information.

In the embodiment of the present application, the configuration datarelated to the spatial information refers to the data that carries oneof the attributes of spatial information in the configuration data. Forexample, the spatial information may be a geographical location and soon.

In a step of S340, the objects are clustered based on the set type ofconfiguration data to obtain a configuration clustering set of theobjects clustered based on the set type of configuration data.

It should be noted that the type of configuration data selected forclustering depends on the KPI or PI indicators for which anomalydetection is performed. For example, if the indicators to be subjectedto anomaly detection are those related to radio frequency, theconfiguration parameters related to radio frequency are selected forclustering. Alternatively, if the indicators to be subjected to anomalydetection are those related to calls, the configuration parametersrelated to calls are selected for clustering. In some implementations,there may be a plurality of configuration clustering sets obtained byclustering configuration data of different types at the same time.

It should be noted that the first clustering set obtained by clusteringthe configuration data includes the spatial clustering set in the step330 and the configuration clustering set in the step 340.

It should be noted that step 320, step 330, and step 340 are notrequired to be performed in a specific order, and they may be performedin the order described in the above examples, or in a reverse order ormay be performed simultaneously.

FIG. 4 is a processing flow chart of determining a clustering set in theanomaly detection method provided in the embodiment of the presentapplication. As shown in FIG. 4, the processing flow of acquiringperformance indicator data of the objects, and clustering the objectsbased on the performance indicator data to generate a second clusteringset of the objects; clustering the objects based on the operation statedata to generate a third clustering set of the objects; and performinglogical operations on the first clustering set, the second clusteringset and the third clustering set based on a preset rule to obtain atleast one clustering set of the objects includes following steps of S410to S440.

In a step of S410, the performance indicator data and operation statedata of the objects are acquired periodically, and the performanceindicator data and operation state data are cleaned and regularized,respectively.

In the embodiments of the present application, the acquisition cycle ofthe performance indicator data and operation state data is determinedbased on the reporting cycle of the above data. For example, assumingthat the reporting cycle of the performance indicator data or operationstate data in the wireless network communication system is x minutes,the acquisition cycle of the performance indicator data and operationstate data of the acquired objects in the embodiments of the presentapplication may also be x minutes. In some implementations, theacquisition cycle may also be an integer multiple of the reporting cycleaccording to the needs of the actual usage scenario, which is notspecifically defined in the embodiments of the present application.

In the embodiments of the present application, the operation state dataincludes data such as call detail records, complaint records,measurement reports (MR) or Call Detail Trace (CDT) of users. Theperformance indicator data includes traffic-related indicator data. Thetraffic-related indicator data may be data corresponding to indicatorssuch as traffic data volume or switching times.

In a step of S420, the objects in the wireless communication networksystem are clustered based on the traffic-related indicator data toobtain a traffic clustering set clustered based on the traffic-relatedindicator data.

It should be noted that, since the traffic belongs to the performanceindicator, the traffic clustering set obtained by clustering the objectsbased on the traffic-related indicator data belongs to the secondclustering set obtained by clustering the objects based on theperformance indicator data.

In a step of S430, the objects in the wireless communication networksystem are clustered based on the operation state data to obtain anoperation state clustering set clustered based on the operation statedata.

It should be noted that the operation state clustering set belongs tothe third clustering set.

In a step of S440, logical operations are performed on the spatialclustering set, the configuration clustering set, the traffic clusteringset and the operation state clustering set based on the preset rule toobtain at least one clustering set of the objects.

In the embodiments of the present application, the preset rule islimiting information that limits the logical operator or operationalorder of the logical operation. Logical operations, which are performedon the spatial clustering set, the configuration clustering set, thetraffic clustering set, and the operation state clustering set based ondifferent preset rules, may lead to different results. The preset ruleto be selected may be determined based on the target of anomalydetection. For example, the preset rule may be the configurationclustering set AND the traffic clustering set AND the operation stateclustering set XOR the spatial clustering set, where AND is a logicaloperator that represents an AND operation, and XOR is a logical operatorthat represents an exclusive OR operation. Logical operations, which areperformed on the spatial clustering set, the configuration clusteringset, the traffic clustering set, and the operation state clustering setbased on the above preset rule, result in that objects with similarconfigurations, traffic and operation state but different spatialpositions are included in one clustering set. For another example, thepreset rule may be the configuration clustering set AND the spatialclustering set AND the operation state clustering set XOR the trafficclustering set. Logical operations, which are performed on the spatialclustering set, the configuration clustering set, the traffic clusteringset, and the operation state clustering set based on the above presetrule, result in that objects with similar configuration, operation stateand spatial position but different traffic are included in oneclustering set. For another example, the preset rule may be theconfiguration clustering set AND the traffic clustering set AND theoperation state clustering set AND the spatial clustering set. Logicaloperations, which are performed on the spatial clustering set, theconfiguration clustering set, the traffic clustering set, and theoperation state clustering set based on the above preset rule, result inthat objects with similar configurations, traffic and operation stateand the same spatial position are included in one clustering set.

FIG. 5 is a flow chart of another anomaly detection method provided inthe embodiment of the present application. As shown in FIG. 5, theanomaly detection method includes following steps of S501 to S511.

In a step of S501, the performance indicator data and operation statedata of the objects are acquired periodically, and the performanceindicator data and operation state data are cleaned and regularized,respectively.

In a step of S502, the objects in the wireless communication networksystem are clustered based on the operation state data to obtain anoperation state clustering set clustered based on the operation statedata.

In a step of S503, the objects in the wireless communication networksystem are clustered based on the traffic-related indicator data toobtain a traffic clustering set clustered based on the traffic-relatedindicator data.

In a step of S504, a spatial clustering set and a configurationclustering set of the objects are acquired.

In a step of S505, logical operations are performed on the spatialclustering set, the configuration clustering set, the traffic clusteringset and the operation state clustering set based on the preset rule toobtain at least one clustering set of the objects.

In some implementations, at least one clustering set of the objects maybe stored in a list, and the list storing at least one clustering set iscalled a clustering set list.

In a step of S506, all clustering sets in the clustering set list areacquired, and an algorithm configuration parameter corresponding to eachclustering set are determined based on a preset anomaly detectionalgorithm and the performance indicator data corresponding to theobjects in the clustering set.

In the embodiments of the present application, the algorithmconfiguration parameter include a configuration parameter or a thresholdrequired by the anomaly detection algorithm. It should be noted thatwhich algorithm is selected as the preset anomaly detection algorithm isdetermined based on the actual application scenario, which is notspecifically defined in the embodiments of the present application. Insome implementations, the objects in different states may be classifiedthrough the above logical operations, thus simplifying the applicationscenario, and a relatively simple anomaly detection algorithm such asVector Auto Regression (VAR) may be selected.

In a step of S507, abnormal performance indicator data of the objects inthe corresponding clustering set is determined based on the algorithmconfiguration parameter, and the abnormal objects are determined basedon the abnormal performance indicator data. In some embodiments, basedon the algorithm configuration parameter corresponding to eachclustering set determined in the above steps, a preset anomaly detectionalgorithm is adopted to perform anomaly detection on the performanceindicator data of the objects in each clustering set to obtain abnormalperformance indicator data. Based on the corresponding relationshipbetween the performance indicator data and the objects, abnormal objectscorresponding to the abnormal performance indicator data are determined.

In a step of S508, a set of abnormal objects to be determined isgenerated based on the abnormal objects.

In a step of S509, a logical dependency between the objects in thewireless communication network system is acquired.

In a step of S510, a logical causality between the abnormal objects inthe set of abnormal objects to be determined is determined based on thelogical dependency between the objects.

FIG. 6 is a schematic diagram of a logical dependency between objectsprovided in the embodiment of the present application. As shown in FIG.6, object 0 has a logical dependency with three other types of objects(i.e., objects 0-0, 0-1 and 0-2), where the object 0-0 has a logicaldependency with object 0-0-0 and object 0-0-1, respectively; the object0-1 has a logical dependency with object 0-1-0 and object 0-1-1,respectively; and the object 0-2 has a logical dependency with object0-2-0 and object 0-2-1, respectively.

In a step of S511, the set of abnormal objects to be determined isadjusted based on the logical causality to obtain the set of abnormalobjects.

In some embodiments, based on the logical dependency between objects, anabnormal object and an object having a logical dependency with theabnormal object (the object at a parent node) are acquired by performinga traversal downward from a topmost child node, to determine whether theabnormal object and the object at the parent node have similar anomaliesin performance indicators. If so, the abnormal object as a child node isdeleted from the set of abnormal objects to be determined. Otherwise, nooperation is performed. In the case that there are still abnormalobjects on which the traversal has not been performed in the clusteringset, new abnormal objects are acquired and the above process isrepeated. In the case that a traversal has been performed on theabnormal objects in all clustering sets in the clustering set list, theadjusted set of abnormal objects to be determined will be taken as afinal set of abnormal objects.

FIG. 7 is a schematic diagram of attribution reduction of abnormalobjects provided in the embodiment of the present application. As shownin FIG. 7, objects 0-0, 0-0-0 and 0-0-1 have similar performanceanomalies, and the object 0-0 is an object at the parent node, while theobjects 0-0-0 and 0-0-1 are both objects at the child nodes. The anomalyof the object at the child node is probably caused by the object at theparent node, so the objects 0-0-0 and 0-0-1 may be deleted from the setof abnormal objects to be determined.

With the above scheme, when the objects at the child node have similaranomalies with those at the parent node based on the logical dependencybetween the objects, the anomalies of the objects at the child node areattributed to those at the parent node, so that the attributionreduction of abnormal objects is achieved, redundant data contained inthe set of abnormal objects is reduced, and the accuracy of abnormalobject detection is improved.

FIG. 8 is a schematic structural block diagram of an anomaly detectiondevice provided in the embodiment of the present application. The devicemay be configured in the NMS, and may also exist independently of theNMS. By performing the anomaly detection method provided in theembodiment of the present application, the device can accurately detectabnormal objects in a wireless communication network system. As shown inFIG. 8, the anomaly detection device in the embodiment of the presentapplication includes a clustering set generation module 810, a parameterdetermination module 820, and an anomaly detection module 830.

The clustering set generation module 810 is configured to generate atleast one clustering set of objects based on configuration data andperformance indicator data of the objects.

The parameter determination module 820 is configured to determine analgorithm configuration parameter corresponding to each clustering setbased on a preset anomaly detection algorithm and the performanceindicator data corresponding to the objects in the clustering set.

The anomaly detection module 830 is configured to determine abnormalperformance indicator data of the objects in the correspondingclustering set based on the algorithm configuration parameter, so as todetermine abnormal objects based on the abnormal performance indicatordata.

The anomaly detection device provided in the embodiment of the presentapplication is configured to implement the anomaly detection method inthe embodiment shown in FIG. 2, and the implementation principle andtechnical effect of the anomaly detection device are similar to those ofthe anomaly detection method, which will not be described in detailhere.

In one example, the object includes function modules for constructingthe wireless communication network system.

In one example, the clustering set generation module 810 is configuredto: generate at least one clustering set of the objects based onconfiguration data, performance indicator data and operation state dataof the objects.

In one example, the operation state data includes one or more of servicequality data, measurement report, call tracing data, signaling tracingdata and user complaint data.

In one example, the clustering set generation module 810 is configuredto:

acquire the configuration data of the objects, and cluster the objectsbased on the configuration data to generate a first clustering set ofthe objects;

acquire the performance indicator data of the objects, and cluster theobjects based on the performance indicator data to generate a secondclustering set of the objects;

acquire the operation state data of the objects, and cluster the objectsbased on the operation state data to generate a third clustering set ofthe objects, where the operation state data includes service qualitydata, measurement report, call tracing data, signaling tracing data oruser complaint data; and

perform logical operations on the first clustering set, the secondclustering set and the third clustering set based on a preset rule toobtain at least one clustering set of the objects.

In one example, the parameter determination module 820 is configured to:

train the preset anomaly detection algorithm based on the performanceindicator data of the objects in each clustering set to obtain thealgorithm configuration parameter corresponding to each clustering set.

In one example, the anomaly detection module 830 is configured to:

acquire target performance indicator data corresponding to the objectsin the clustering set to be detected;

determine a target algorithm configuration parameter corresponding tothe clustering set to be detected; and

perform anomaly detection on the target performance indicator data basedon the preset anomaly detection algorithm and the target algorithmconfiguration parameter, and determine abnormal performance indicatordata in the target performance indicator data based on anomaly detectionresults.

In one example, the anomaly detection device further includes a setadjustment module.

The set adjustment module is configured to, after determining anabnormal object based on the abnormal performance indicator data,generate a set of abnormal objects to be determined based on theabnormal objects; acquire a dependency between the objects in thewireless communication network system, where the dependency isdetermined based on the configuration data; determine a logicalcausality between the abnormal objects in the set of abnormal objects tobe determined based on the dependency between the objects; and adjustthe set of abnormal objects to be determined based on the logicalcausality to obtain a set of abnormal objects.

FIG. 9 is a processing flow diagram of another anomaly detection deviceprovided in the embodiment of the present application. In animplementation, the anomaly detection device may include a performanceindicator data preprocessing (loading, cleaning and regularization)module 901, an anomaly detection algorithm module 902, a configurationdata preprocessing (loading, cleaning and regularization) module 903, anoperation state data preprocessing (loading, cleaning andregularization) module 904, an object dependency generation module 905,a configuration clustering set generation module 906, an operation stateclustering set generation module 907, a traffic clustering setgeneration module 908, a clustering set generation module 909, analgorithm configuration parameter generation module 910 and an abnormalobject attribution reduction module 911.

The performance indicator data preprocessing module 901 is configured toread performance indicator data, clean and regularize the data, and sendthe cleaned and regularized data to the anomaly detection algorithmmodule 902 and the traffic clustering set generation module 908,respectively.

The configuration data preprocessing module 903 is configured to readconfiguration data of a wireless communication network system, clean andregularize the data, and send the cleaned and regularized data to theobject dependency generation module 905 and the configuration clustergeneration module 906, respectively.

The operation state data preprocessing module 904 is configured to readoperation state data of objects in the wireless communication networksystem, clean and regularize the data, and send the cleaned andregularized data to the operation state clustering set generation module907.

The object dependency generation module 905 is configured to generate alogical dependency between the objects based on the configuration data,and send the logical dependency to the abnormal object attributionreduction module 911.

The configuration clustering set generation module 906 is configured tocluster the objects based on the configuration data to obtain aconfiguration clustering set and a spatial clustering set of theobjects, and send the configuration clustering set and the spatialclustering set to the clustering set generation module 909.

The operation state clustering set generation module 907 is configuredto cluster the objects based on the operation state data to obtain anoperation state clustering set of the objects, and send the operationstate clustering set to the clustering set generation module 909.

The traffic clustering set generation module 908 is configured tocluster the objects based on the traffic to obtain a traffic clusteringset of the objects, and send the traffic clustering set to theclustering set generation module 909.

The clustering set generation module 909 is configured to performlogical operations on the spatial clustering set, the configurationclustering set, the traffic clustering set and the operation stateclustering set based on the preset rule to obtain at least oneclustering set of the objects. In some implementations, at least oneclustering set of the objects may be stored in a clustering set list.The clustering set generation module 909 sends the clustering set listto the algorithm configuration parameter generation module 910.

The algorithm configuration parameter generation module 910 isconfigured to generate an algorithm configuration parameter for eachclustering set based on a preset anomaly detection algorithm and theperformance indicator data corresponding to the objects in theclustering set list, and send the parameter to the anomaly detectionalgorithm module 902.

The anomaly detection algorithm module 902 is configured to performanomaly detection on the performance indicator data in the correspondingclustering set based on the algorithm configuration parametercorresponding to each clustering set, generate a set of anomaly objectsto be determined, and send the set to the anomaly object attributionreduction module 911.

The abnormal object attribution reduction module 911 is configured todetermine a logical causality between the abnormal objects in the set ofabnormal objects to be determined based on the logical dependency of theobjects, determine target abnormal objects that meets a setting rule inthe set of abnormal objects to be determined based on the logicalcausality, delete the target abnormal objects to obtain a set ofabnormal objects, and output the set of abnormal objects.

For ease of understanding, a processing flow of the anomaly detectionmethod in the embodiments of the present application is described byfollowing examples. FIG. 10 is a schematic diagram of a wirelesscommunication network system provided in the embodiment of the presentapplication. Assuming that there is a simplified wireless communicationnetwork system, as shown in FIG. 10, the wireless communication networksystem includes a core network and five base stations.

1) The core network is numbered as: CN_0.

2) Five base stations are numbered as: B_0-B_4.

3) Each base station manages 2 cells (10 cells in total), and the cellsare numbered as: C_0_0-C_4_1, where the second digit is the base stationnumber (0-4) to which the cell belongs, and the third digit is the cellnumber (0-1).

4) There is a logical transmission link between each cell and the basestation, numbered as: LL-0_0-LL_4_1.

5) There is a physical transmission link between each base station andCN, numbered as: PL_0-PL_4.

6) It is assumed that the 10 cells mainly cover two geographicallocations: LOC_0-LOC_1, where four cells under the management of B_0 andB_1 cover LOC_0, and six cells under the management of B_2, B_3 and B_4cover LOC_1.

7) It is assumed that there are a total of two different wirelessparameter configurations in these cells, which are represented by acircle containing a horizontal line and a circle containing a verticalline in the figure.

8) It is assumed that some cells represented by a gray background in thefigure are currently in a high traffic state, and that some cellsrepresented by a white background in the figure are in a low trafficstate.

9) It is assumed that the current operation transition data is only calldetail record data of users, which is basically the same for all cells.

The implementation process of the anomaly detection method in theembodiment of the present application will be described based on theabove assumptions.

1. The configuration data preprocessing module first acquiresconfiguration data, cleans and regularizes the data, and generates adependency diagram of objects. At this time, the anomaly detectiondevice has learned which objects are included in the wireless networkcommunication system and the parent-child dependency between theobjects, and kept the dependency data for future use. The processedconfiguration data is then sent to the configuration cluster generationmodule.

2. The configuration cluster generation module operates theconfiguration data related to spatial information based on DBSCANclustering algorithm, so as to obtain a cell clustering set clusteredbased on geographical locations and a cell clustering set clusteredbased on wireless parameter configurations.

3. The cells in the wireless communication network system are clusteredbased on the geographical location to obtain two spatial clusteringsets:

LOC_1: [C_0_0,C_0_1,C_1_0,C_1_1]

LOC_2: [C_2_0,C_2_1,C 3_0,C 3_1,C_4_0,C_4_1]

The cells in the wireless communication network system are clusteredbased on the wireless configurations to obtain two configurationclustering sets:

a. [C_0_0,C_0_1,C_2_0,C_2_1,C_4_1]

b. [C_1_0,C_1_1,C 3_0,C 3_1,C 4_0]

The data is kept for future use.

4. The performance indicator data preprocessing module reads theperformance indicator data reported by the system, cleans andregularizes the data, and then sends the data to the traffic clusteringset generation module while caching the data and then providing the datafor the anomaly detection algorithm module after the anomaly detectionalgorithm module is ready.

5. The operation state data preprocessing module reads the operationstate data reported by the system (the data is the call detail record ofusers in this case), cleans and regularizes the data, and then sends thedata to the operation state clustering set generation module.

6. The traffic clustering set generation module operates the receivedperformance indicator data based on DBSCAN clustering algorithm toobtain a cell clustering set clustered based on the traffic.

7. The operation state clustering set generation module operates thereceived operation state data based on the DBSCAN clustering algorithmto obtain a cell clustering set clustered based on the operation statedata.

8. The cells in the wireless communication network system are clusteredbased on the traffic to obtain two traffic clustering sets:

high traffic: [C_0_1,C_1_0,C 3_0,C_3_1,C_4_1]

low traffic: [C_0_0,C_1 1,C 2_0,C_2_1,C 4_0]

The cells in the wireless communication network system are clusteredbased on the operation state data to obtain an operation stateclustering set, which includes all cells. The data is kept for futureuse.

9. The clustering set generation module may obtain a clustering set listthrough set operations based on the cluster data obtained in the steps 3and 8, including the wireless configuration clustering set AND theoperation state clustering set AND the traffic volume clustering set XORthe spatial clustering set, so that all clustering sets of cells withsimilar wireless configurations, operation states and traffic butdifferent geographical positions may be obtained.

10. The final clustering set list of the cells is as follows:

a. [C_0_0, C_2_0]

b. [C_0_0, C_2_1]

c. [C_0_1, C_4_1]

d. [C_1_0, C_3_0]

e. [C_1_0, C_3_1]

f. [C_1_1, C_4_0]

The data is sent to the algorithm configuration parameter generationmodule.

11. The algorithm configuration parameter generation module trains,through vector autoregressive approach, the cell performance indicatordata in each clustering set grouped based on the obtained clustering setlist, so as to obtain algorithm configuration parameter applicable tothis group. Once the algorithm configuration has been calculated for allthe clustering sets in the clustering set list, the algorithmconfiguration parameter of each clustering set are transferred to theanomaly detection algorithm module.

12. The anomaly detection algorithm module acquires the performanceindicator data from the performance indicator data preprocessing module,as well as the clustering set list and the algorithm configurationparameter applicable to each clustering set from the algorithmconfiguration parameter generation module, and then performs anomalydetection on the cells in each clustering set through the vectorautoregressive algorithm. After all clustering sets are detected, a setof abnormal objects to be determined is output to the abnormal objectattribution reduction module.

13. The abnormal object attribution reduction module performsattribution reduction on the set of abnormal objects to be determinedthrough the dependency diagram of objects obtained in the step 1. Forexample, referring to FIG. 10, the anomaly detection algorithm showsthat LL_1_1, LL_3_0, LL_3 _1 and PL_3 have similar anomalies in theindicator of packet loss probability. Based on the dependency betweenthe objects, the abnormal object attribution reduction module determinesthat neither the objects at the nodes adjacent to LL_1_1 nor the objectat the parent node of LL_1_1 have anomalies, so the anomalies are onlylimited to LL_1_1 itself and it is not necessary to reduce the objects.However, PL_3 is an abnormal parent node, and all its child nodes havesimilar anomalies, so the anomalies of the child nodes are probablycaused by the parent node. Therefore, it is decided to reduce all thechild nodes, leaving only the abnormal object of PL_3. At this point,the attribution reduction is finished, and the set of abnormal objectsis obtained.

14. The set of abnormal objects is output.

An embodiment of the present application provides a terminal. FIG. 11 isa structure diagram of the terminal provided in the embodiment of thepresent application. As shown in FIG. 11, the terminal includes a memory1110 and one or more processors 1120. The memory 1110 is configured tostore one or more programs which, when executed by the one or moreprocessors 1120, cause the one or more processors 1120 to implement theanomaly detection method described in the embodiments of the presentapplication.

The terminal provided above may be configured to execute the anomalydetection method provided in any of the above embodiments, and hascorresponding functions and beneficial effects.

An embodiment of the present application also provides a storage mediumfor storing executable instructions which, when executed by a computerprocessor, cause the computer processor to perform an anomaly detectionmethod including:

generating at least one clustering set of objects based on configurationdata and performance indicator data of the objects;

determining an algorithm configuration parameter corresponding to eachclustering set based on a preset anomaly detection algorithm and theperformance indicator data corresponding to the objects in theclustering set; and

determining abnormal performance indicator data of the objects in thecorresponding clustering set based on the algorithm configurationparameter, so as to determine abnormal objects based on the abnormalperformance indicator data.

The above is merely a number of embodiments of the present application,and is not intended to limit the scope of protection of the presentapplication.

In general, various embodiments of the present application may beimplemented in hardware or dedicated circuitry, software, logic, or anycombination thereof. For example, some aspects may be implemented inhardware, while other aspects may be implemented in firmware or softwarethat may be executed by a controller, microprocessor, or other computingdevice, although the present application is not limited thereto.

A block diagram of any logic flow in the accompanying drawings of thepresent application may represent program steps, or may representinterconnected logic circuits, modules, and functions, or may representa combination of program steps and logic circuits, modules, andfunctions. A computer program may be stored in a memory. The memory maybe of any type suitable for a local technical environment and may beimplemented using any suitable data storage technology, such as, but notlimited to, read only memory (ROM), random access memory (RAM), opticalmemory device and system (digital versatile disc (DVD) or CD disc). Thecomputer readable medium may include a non-transitory storage medium.The data processor may be of any type suitable for a local technicalenvironment, such as, but not limited to, general purpose computer,special purpose computer, microprocessor, digital signal processor(DSP), application specific integrated circuit (ASIC), fieldprogrammable gate array (FGPA), and processor based on a multi-coreprocessor architecture.

1. An anomaly detection method, comprising: generating at least oneclustering set of objects based on configuration data and performanceindicator data of the objects; determining an algorithm configurationparameter corresponding to each clustering set based on a preset anomalydetection algorithm and the performance indicator data corresponding tothe objects in the clustering set; and determining, based on thealgorithm configuration parameter, abnormal performance indicator dataof the objects in the corresponding clustering set, so as to determineabnormal objects based on the abnormal performance indicator data. 2.The method of claim 1, wherein the objects comprise function modules forconstructing a wireless communication network system.
 3. The method ofclaim 1, wherein the generating at least one clustering set of objectsbased on configuration data and performance indicator data of theobjects comprises: generating at least one clustering set of the objectsbased on configuration data, performance indicator data and operationstate data of the objects.
 4. The method of claim 3, wherein theoperation state data comprises one or more of service quality data,measurement report, call tracing data, signaling tracing data, and usercomplaint data.
 5. The method of claim 3, wherein the generating atleast one clustering set of the objects based on configuration data,performance indicator data and operation state data of the objectscomprises: acquiring the configuration data of the objects, andclustering the objects based on the configuration data to generate afirst clustering set of the objects; acquiring the performance indicatordata of the objects, and clustering the objects based on the performanceindicator data to generate a second clustering set of the objects;acquiring the operation state data of the objects, and clustering theobjects based on the operation state data to generate a third clusteringset of the objects; and performing logical operations on the firstclustering set, the second clustering set and the third clustering setbased on a preset rule to obtain at least one clustering set of theobjects.
 6. The method of claim 1, wherein the determining an algorithmconfiguration parameter corresponding to each clustering set based on apreset anomaly detection algorithm and the performance indicator datacorresponding to the objects in the clustering set comprises: trainingthe preset anomaly detection algorithm based on the performanceindicator data of the objects in each clustering set to obtain thealgorithm configuration parameter corresponding to each clustering set.7. The method of claim 1, wherein the determining, based on thealgorithm configuration parameter, abnormal performance indicator dataof the objects in the corresponding clustering set comprises: acquiringtarget performance indicator data corresponding to the objects in theclustering set to be detected; determining a target algorithmconfiguration parameter corresponding to the clustering set to bedetected; and performing anomaly detection on the target performanceindicator data based on the preset anomaly detection algorithm and thetarget algorithm configuration parameter, and determining abnormalperformance indicator data in the target performance indicator databased on anomaly detection results.
 8. The method of claim 1, furthercomprising: after the determining an abnormal object based on theabnormal performance indicator data, generating, a set of abnormalobjects to be determined based on the abnormal objects; acquiring alogical dependency between the objects in the wireless communicationnetwork system, wherein the logical dependency is determined based onthe configuration data; determining a logical causality between theabnormal objects in the set of abnormal objects to be determined basedon the logical dependency between the objects; and adjusting the set ofabnormal objects to be determined based on the logical causality toobtain a set of abnormal objects. 9.-11. (canceled)
 12. A device,comprising: a memory, and one or more processors, wherein the memory isconfigured to store one or more programs; and the one or more programs,when executed by the one or more processors, cause the one or moreprocessors to perform an anomaly detection method comprising: generatingat least one clustering set of objects based on configuration data andperformance indicator data of the objects; determining an algorithmconfiguration parameter corresponding to each clustering set based on apreset anomaly detection algorithm and the performance indicator datacorresponding to the objects in the clustering set; and determining,based on the algorithm configuration parameter, abnormal performanceindicator data of the objects in the corresponding clustering set, so asto determine abnormal objects based on the abnormal performanceindicator data.
 13. The device of claim 12, wherein the objects comprisefunction modules for constructing a wireless communication networksystem.
 14. The device of claim 12, wherein the generating at least oneclustering set of objects based on configuration data and performanceindicator data of the objects comprises: generating at least oneclustering set of the objects based on configuration data, performanceindicator data and operation state data of the objects.
 15. The deviceof claim 14, wherein the operation state data comprises one or more ofservice quality data, measurement report, call tracing data, signalingtracing data, and user complaint data.
 16. The device of claim 14,wherein the generating at least one clustering set of the objects basedon configuration data, performance indicator data and operation statedata of the objects comprises: acquiring the configuration data of theobjects, and clustering the objects based on the configuration data togenerate a first clustering set of the objects; acquiring theperformance indicator data of the objects, and clustering the objectsbased on the performance indicator data to generate a second clusteringset of the objects; acquiring the operation state data of the objects,and clustering the objects based on the operation state data to generatea third clustering set of the objects; and performing logical operationson the first clustering set, the second clustering set and the thirdclustering set based on a preset rule to obtain at least one clusteringset of the objects.
 17. The device of claim 12, wherein the determiningan algorithm configuration parameter corresponding to each clusteringset based on a preset anomaly detection algorithm and the performanceindicator data corresponding to the objects in the clustering setcomprises: training the preset anomaly detection algorithm based on theperformance indicator data of the objects in each clustering set toobtain the algorithm configuration parameter corresponding to eachclustering set.
 18. The device of claim 12, wherein the determining,based on the algorithm configuration parameter, abnormal performanceindicator data of the objects in the corresponding clustering setcomprises: acquiring target performance indicator data corresponding tothe objects in the clustering set to be detected; determining a targetalgorithm configuration parameter corresponding to the clustering set tobe detected; and performing anomaly detection on the target performanceindicator data based on the preset anomaly detection algorithm and thetarget algorithm configuration parameter, and determining abnormalperformance indicator data in the target performance indicator databased on anomaly detection results.
 19. The device of claim 12, whereinthe one or more programs, when executed by the one or more processors,further cause the one or more processors to perform steps of: after thedetermining an abnormal object based on the abnormal performanceindicator data, generating, a set of abnormal objects to be determinedbased on the abnormal objects; acquiring a logical dependency betweenthe objects in the wireless communication network system, wherein thelogical dependency is determined based on the configuration data;determining a logical causality between the abnormal objects in the setof abnormal objects to be determined based on the logical dependencybetween the objects; and adjusting the set of abnormal objects to bedetermined based on the logical causality to obtain a set of abnormalobjects.
 20. A storage medium storing a computer program, wherein thecomputer program, when executed by a processor, causes the processor toperform an anomaly detection method comprising: generating at least oneclustering set of objects based on configuration data and performanceindicator data of the objects; determining an algorithm configurationparameter corresponding to each clustering set based on a preset anomalydetection algorithm and the performance indicator data corresponding tothe objects in the clustering set; and determining, based on thealgorithm configuration parameter, abnormal performance indicator dataof the objects in the corresponding clustering set, so as to determineabnormal objects based on the abnormal performance indicator data. 21.The storage medium of claim 20, wherein the objects comprise functionmodules for constructing a wireless communication network system. 22.The storage medium of claim 20, wherein the generating at least oneclustering set of objects based on configuration data and performanceindicator data of the objects comprises: generating at least oneclustering set of the objects based on configuration data, performanceindicator data and operation state data of the objects.
 23. The storagemedium of claim 22, wherein the operation state data comprises one ormore of service quality data, measurement report, call tracing data,signaling tracing data, and user complaint data.
 24. The storage mediumof claim 22, wherein the generating at least one clustering set of theobjects based on configuration data, performance indicator data andoperation state data of the objects comprises: acquiring theconfiguration data of the objects, and clustering the objects based onthe configuration data to generate a first clustering set of theobjects; acquiring the performance indicator data of the objects, andclustering the objects based on the performance indicator data togenerate a second clustering set of the objects; acquiring the operationstate data of the objects, and clustering the objects based on theoperation state data to generate a third clustering set of the objects;and performing logical operations on the first clustering set, thesecond clustering set and the third clustering set based on a presetrule to obtain at least one clustering set of the objects.
 25. Thestorage medium of claim 20, wherein the determining an algorithmconfiguration parameter corresponding to each clustering set based on apreset anomaly detection algorithm and the performance indicator datacorresponding to the objects in the clustering set comprises: trainingthe preset anomaly detection algorithm based on the performanceindicator data of the objects in each clustering set to obtain thealgorithm configuration parameter corresponding to each clustering set.26. The storage medium of claim 20, wherein the determining, based onthe algorithm configuration parameter, abnormal performance indicatordata of the objects in the corresponding clustering set comprises:acquiring target performance indicator data corresponding to the objectsin the clustering set to be detected; determining a target algorithmconfiguration parameter corresponding to the clustering set to bedetected; and performing anomaly detection on the target performanceindicator data based on the preset anomaly detection algorithm and thetarget algorithm configuration parameter, and determining abnormalperformance indicator data in the target performance indicator databased on anomaly detection results.
 27. The storage medium of claim 20,wherein the computer program, when executed by a processor, furthercauses the processor to perform steps of: after the determining anabnormal object based on the abnormal performance indicator data,generating, a set of abnormal objects to be determined based on theabnormal objects; acquiring a logical dependency between the objects inthe wireless communication network system, wherein the logicaldependency is determined based on the configuration data; determining alogical causality between the abnormal objects in the set of abnormalobjects to be determined based on the logical dependency between theobjects; and adjusting the set of abnormal objects to be determinedbased on the logical causality to obtain a set of abnormal objects.